ScoriaReleases
A v* tag builds the scoria binary on both forges and publishes one
archive per platform with a SHA256SUMS file over all of them. Every release
since 0.1.0 is listed here, newest first, and the three download addresses below always
point at the newest one.
Those addresses are versionless on purpose: they resolve to whatever the newest release is, so a link to them never goes stale. Each release also carries the same three archives named for their tag, which is what you want in a downloads folder you will come back to.
0.3.2 — an address that does not go stale
Released 23 October 2026. Nothing in the application changed: this release exists to put the three permanent download addresses above into a release, and it carries the recordings the README and this site are illustrated with, together with the small vault they were made on.
Two names for every archive
Each archive is published twice: once named for its tag, and once under a name with no
version in it. GitHub resolves /releases/latest/download/<name> by exact
file name, so the versionless one is an address that keeps working across releases — which
is what the buttons on this site now point at. SHA256SUMS lists both names, so
checking a download works whichever address you took.
What the app actually looks like
The README's screenshots and recordings were remade against the current window and now illustrate the manual too — the three-pane shell, reading view, embeds and the canvas, search and the switcher, and Live Preview completing a link. They are driven over the control socket in a headless session, so they can be remade rather than curated.
A field guide to scoria
The vault the recordings are made on ships with the repository: a small geology field guide with a properties table, photographs, embeds, a canvas and enough links for the graph to have a shape. It is there so the recordings can be reproduced, and because screenshots of an empty vault teach nothing.
Earlier releases
The headline of each, with the full commit list on the forge. Nothing has been yanked: every tag below is still downloadable, archives and checksums intact.
| Version | Date | What it was | Notes |
|---|---|---|---|
| 0.3.1 | 23 Oct 2026 | The other two platforms: Obsidian's macOS frame with the traffic lights and no title, GPUI's macOS text system, the control socket and a building test suite on Windows, and the Search pane rebuilt against what a probe saw Obsidian's own pane do. | v0.3.1 |
| 0.3.0 | 22 Oct 2026 | The canvas view: a .canvas opens in the main area and pans, zooms,
selects, moves, resizes, draws edges and autosaves in Obsidian's bytes. The Files
header, the right dock's order and the Backlinks, Outgoing links, Tags, All properties
and Outline panes were all rebuilt from probes, and tabs drag between groups. |
v0.3.0 |
| 0.2.1 | 21 Oct 2026 | The hidden window frame on Windows too, and the release signing key named and kept out of CI. | v0.2.1 |
| 0.2.0 | 21 Oct 2026 | The writing release: the typed properties table, settings written back, autocompletion for links, headings, aliases, tags and block references, the sixteen table commands with cell editing, templates, daily notes, the round-trip harness, the canvas writer, and the control socket with its MCP server. | v0.2.0 |
| 0.1.0 | 17 Oct 2026 | First tagged release, at the end of the reader phase: the three-pane shell, reading view, the link panes, search, the switcher, the graph, the palette and a Settings modal that showed your real configuration. | v0.1.0 |
Scoria is before 1.0 and the minor number is where the work shows: 0.2 was writing, 0.3 is
the shell and the other platforms. A tag with a hyphen in it — v0.4.0-rc1 — is
published as a prerelease and is not what the addresses above resolve to. Releases before
0.3.2 carry their archives under the tagged names only.
Checking what you downloaded
Three independent checks, in increasing order of what they prove. None of them needs an account, and the first one is the one worth doing every time.
sha256sum -c --ignore-missing SHA256SUMS # the archive is the one CI built
gh attestation verify scoria-linux-x86_64.tar.gz \
--repo ragtux/scoria # ...from this workflow, at this commit
gpg --verify SHA256SUMS.asc SHA256SUMS # ...and the checksums are signed
SHA256SUMS lists both names of every archive, so the check works whether you
took the versionless address or the tagged one. On macOS the first command is
shasum -a 256 -c --ignore-missing SHA256SUMS, and on Windows
Get-FileHash prints a hash to compare by eye.
The signing key is
69BF AA44 7DAC E6C3 EF02 6CBA 4EA6 7A61 88DA 92BD
(ragtux <ragtux@outlook.com>), which
gpg --keyserver keys.openpgp.org --recv-keys 4EA67A6188DA92BD fetches; each
release's notes repeat the fingerprint that signed it. A release published without the key
available says so in its notes rather than carrying an unsigned .asc.
How a release is made
The same tag, pushed twice
A v* tag on GitHub builds
all three platforms; the same tag on
git.ragtux.com builds the Linux archive,
because the homelab runner has only a Linux container. Same commit, same
Cargo.lock, same binary.
The tag has to match the manifest
The first job compares the tag against the workspace version and fails the release before a build slot is spent if they disagree — the archives are named from the tag and the binary reports the manifest, so a mismatch would ship a lie.
Built --locked
Cargo.lock pins libc and the exact GPUI revision on purpose,
and the release job builds with --locked so the lockfile decides. Building the
tag yourself gives you the same dependency graph CI used.